Privacy Policy
Last updated in October 2026
Marloo is committed to protecting your privacy. This Privacy Policy outlines how we collect, use, store, and share Personal Information (as defined below), ensuring that your data is handled responsibly and securely. This is an Australia-only privacy policy: it applies only to customers located in Australia.
This Privacy Policy may be updated periodically to reflect changes in our practices, legal requirements, or other factors. All changes will be communicated by publishing a copy of the updated Privacy Policy on our website. We encourage you to review it periodically.
1. Introduction and scope
1.1 We are Marloo AU Pty Ltd, a company incorporated in Australia (ACN 700 023 454) whose registered office is at 121 Castlereagh St, Sydney NSW 2000, Australia ("we", "us", and "our"). This Privacy Policy explains how we collect, use, store and protect your Personal Information where we act as the controller of that information. This Privacy Policy applies to customers located in Australia. Customers located in other countries are subject to the privacy policy applicable to their country.
1.2 Marloo is an AI assistant for financial advisers that processes various inputs (including calendar events, meetings, calls, and uploaded documents) to automate administrative tasks, create a unified client record, and generate draft advice documents such as fact-finds and review letters (the "Marloo Service"). The term "Marloo Service" in this Privacy Policy includes any associated products or services that we may offer from time to time. Marloo maintains websites at https://www.marloo.com, https://www.gomarloo.com and https://app.marloo.com (each, a "Site") which include information about Marloo and the Marloo Service.
1.3 For those who purchase or otherwise interact with us or the Marloo Service, all visitors to the Site, and all other individuals with whom we communicate in the course of running our business (each referred to as "you" and "your"), Marloo AU Pty Ltd is the controller of your Personal Information. This means that we decide which Personal Information we collect, and how to use it. The measures and rights set out in this Privacy Policy apply only where we act as the controller of your Personal Information. Where we process Personal Information on behalf of third parties, we have Data Processing Agreements in place where required by applicable law.
2. Meaning of Personal Information
2.1 Under the Australian Privacy Act 1988 (Cth) ("APA"), "Personal Information" means "Information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not."
3. What we collect, how we collect it, and what we do with it
3.1 The Personal Information we collect from you, and how we collect it, will depend on the service you are purchasing and the way you interact with us.
3.2 The table below sets out what we collect, how we collect it and what we do with it. We may state a more specific additional purpose when we collect your Personal Information.
TABLE 1 — What we collect, how we collect it, and what we do with it
| What we collect | How we collect it | Purpose(s) for which it is used |
|---|---|---|
| Visitors to the site | ||
| Any information you provide to us voluntarily such as name, phone number, email address, country and city (or full postal address) and the organisation you work for. | When you provide it to us voluntarily through enquiring about our services (including through our online form), by subscribing to marketing communications or giving us feedback | The purpose specified when provided to us To provide you with current information about the Marloo Service, special offers you may find of interest, or new products or services being offered by us, through our newsletter or otherwise. To respond to customer enquiries |
| Technical data including the type of browser you are using, device information and your IP address. Some of this data is collected through cookies. See our cookie notice below for further details. | Automatically when you browse the Site | To provide you with access to the Site To enhance security and prevent fraud To monitor service integrity To make improvements to the Site To perform routine analysis on the performance of our services and business more generally To administer or perform our contract with service providers To protect our business and defend ourselves against legal claims To serve targeted advertising to you on third-party platforms, and to measure the effectiveness of our advertising campaigns |
| Customers (primarily financial advisers) of the Marloo Service | ||
| Information you provide to us in order to purchase the Marloo Service such as name, phone number, email address, country and city (or full postal address) and the organisation you work for. | When you input the information on the Site in order to sign up to the Marloo Service | To provide the Marloo Service to you (including the provision of technical support) To process your payment information in connection with any contract we have with you To perform accounting, billing and other administrative and operational functions To send you updates about the Marloo Service you have purchased For customer support To respond to customer enquiries To enhance security and prevent fraud |
| Login details | Through cookies | To verify your identity (so that you can log in) To make logging in easier (so that you do not need to type in your username each time) |
| Calendar details, meeting details, meeting notes, transcripts, audio recordings, and any other information we are given access to when you integrate your Google and/or Microsoft accounts to the Marloo Service | From third parties – Google, Microsoft or other third party (as applicable), and from the operation of the Marloo Service when meetings or calls are recorded or transcribed at your direction. | To sync calendars and otherwise enable you to make best use of the Marloo Service To contribute to a unified client record for analysis To enable AI-driven analysis across the complete client record |
| Client-related documents and other information you choose to upload. | From your direct input and uploads into the Marloo Service. | To create a unified client record by aggregating all associated meetings, notes, and documents. To enable AI-driven analysis across this entire unified client record. |
| Name, phone number, email address, country and city (or full postal address) and the organisation you work for. | When you input the information on the Site in order to sign up to the Marloo Service | To provide you with current information about the Marloo Service, special offers you may find of interest, or new products or services being offered by us, through our newsletter or otherwise. |
| Participants in our referral program | ||
| Financial information, including bank account holder name, number, and BSB. | When you provide it to us securely after being notified of an earned reward. | To process and transfer cash rewards earned through the Marloo Referral Program. To verify your identity, prevent fraud, and comply with applicable financial regulations. |
3.3 In addition to the purposes set out in the table above, we may use your Personal Information (however collected) where it is necessary for us to comply with our legal obligations:
3.3.1 to record your preferences (e.g. marketing) to ensure that we comply with applicable data protection laws;
3.3.2 where we are required to assist government and law enforcement agencies or regulators;
3.3.3 where we retain information to enable us to bring or defend legal claims; and/or
3.3.4 where we are required to assist government and law enforcement agencies or regulators, including in relation to any eligible data breach declarations by any of them.
4. Anonymised and aggregated data
We may anonymise the Personal Information we collect (so it can no longer identify you) and then combine it with other anonymous information so it becomes aggregated data. Aggregated data helps us identify trends (e.g. what percentage of users responded to a specific survey). Data protection laws do not govern the use of aggregated data and the various rights described below do not apply to it.
5. Use of cookies and similar tracking technologies
5.1 Cookies are small text files that we store on your browser, or the hard drive of your computer, if you agree. Cookies collect data which includes Personal Information.
5.2 We use our own cookies, and similar tracking technologies, to enhance user experience, provide security, and improve our services. We also use third party cookies. The following cookies (or similar technologies) are used on our Site:
5.2.1 Essential cookies. These are cookies that are required for the core functionality of the Site. These essential cookies are always enabled because the Site will not work properly without them. They include, for example, cookies that enable certain authentication and security functions.
5.2.2 Preference cookies. These enable us to recognise you when you return to the Site, to personalise our content for you and remember your preferences.
5.2.3 Performance cookies. These help us to understand how visitors interact with the Site. They include cookies that tell us how long people spend on the Site and the number of times they visit, to improve service functionality.
5.2.4 Advertising and targeting cookies. These are third-party cookies that collect information such as cookie identifiers, IP addresses, and browsing activity on our Site for the purposes of serving targeted advertising on third-party platforms and measuring the effectiveness of our advertising campaigns.
6. Security measures
6.1 We take the security of your Personal Information seriously. We implement technical and organisational measures to protect against unauthorised access, disclosure, and loss of data, including:
6.1.1 Encryption: all data at rest is encrypted using AES-256 encryption. Data in transit is protected by TLS 1.2/1.3 protocols.
6.1.2 Audit trails and monitoring: access logs are retained for a minimum of one year and regularly reviewed for compliance and security monitoring.
6.1.3 Independent assurance: we maintain a SOC 2 Type 2 attestation report covering our security, availability, and confidentiality controls. Our current certificate is available at https://trust.marloo.com.
6.2 If there is an incident that has affected your Personal Information, we will investigate it, take steps to contain it, notify the appropriate regulator and keep you informed (where required under applicable data protection law).
7. How long we keep your Personal Information
7.1 We will only retain your Personal Information for as long as necessary to fulfil the purposes we collected it for.
7.2 To decide how long to keep Personal Information (also known as its retention period), we consider the volume, nature, and sensitivity of the Personal Information, the potential risk of harm to you if an incident were to happen, whether we require the Personal Information to achieve the purposes we have identified or whether we can achieve those purposes through other means (e.g. by using aggregated data instead), and any applicable legal requirements (e.g. minimum accounting records for tax authorities).
7.3 If you have asked for information from us or you have subscribed to our mailing list, we keep your details until you ask us to stop contacting you.
8. Where your Personal Information is stored
8.1 Your Personal Information is stored in Australia, using Supabase infrastructure hosted in Sydney, Australia.
Certain Personal Information may also be processed by our subprocessors in other jurisdictions in order to provide the Marloo Service (for example, for AI processing, transcription, or communication services). A full list of our subprocessors is available at https://trust.marloo.com/subprocessors, and details of the countries in which they process Personal Information are available on request.
9. Who we share your Personal Information with
9.1 We may share your Personal Information with the organisations listed below, for the specified reasons.
9.2 As outlined in clause 14, this may involve transfers overseas.
9.3 When we share your Personal Information with third parties to process your Personal Information on our behalf, we ensure that an appropriate Data Processing Agreement is in place, where required under applicable data protection laws.
9.4 We can provide more detailed information about our specific service providers, their data processing locations, and retention periods upon request. Please contact us at compliance@gomarloo.com for such information.
9.5 We do not use your Personal Information, including any Customer Data, meeting transcripts, or uploaded documents, to train any large language models, whether proprietary or third party.
9.6 Google API data. Marloo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
9.7 Where you connect your Google account, Marloo accesses your Google Drive, Gmail and Calendar data to sync files, send emails on your behalf, and create calendar events. This data is stored securely and retained only as long as needed to provide the service. We never use it for advertising or sell it, and only share it or allow human access where necessary to provide the service, with your consent, or as required by law.
TABLE 2 — Who we share your Personal Information with
| Category of third party | Reason for sharing your Personal Information |
|---|---|
| Service providers used for business operations including: infrastructure services (data storage, cloud hosting, API processing, backup services), security and authentication services (user authentication, web security, content delivery), communication services (email, marketing communications, calendar integration), operational services (workflow management, monitoring, logging), and speech processing and transcription services. Our current providers for these purposes include Supabase, AWS and our other subprocessors, listed at https://trust.marloo.com/subprocessors. Some of these organisations will store your Personal Information only where required for service functionality and for as long as necessary to provide those services. | We rely on these providers to conduct our business |
| AI / Large Language Model Providers We partner with leading AI providers, including Anthropic and OpenAI as our primary large language model (LLM) providers, and Google (for certain features), to enable functionality within the Marloo Service. We have implemented contractual and technical arrangements designed to prevent the retention of inputs processed by these providers beyond what is necessary to provide the Marloo Service, and to prevent the use of your Personal Information for training their models. Where any provider retains limited data temporarily for abuse monitoring or other operational purposes, we have ensured this is consistent with applicable data protection laws. | To provide core AI-driven functionalities such as meeting transcription, summarisation, and analysis. |
| Any authorised government or regulatory or self-regulatory authority or enforcement agency | If we are under a duty to disclose your Personal Information in order to comply with any legal obligation, or to protect the rights, property or safety of Marloo, its clients or others |
| Professional advisers or contractors, such as our auditors, accountants, or lawyers or other professional consultants | To obtain relevant advice in running our business |
| As part of or in connection with a sale of our business, or a merger, reorganisation, investment, change in control, transfer of substantial corporate assets, liquidation or similar transaction | For the purposes of the relevant transaction |
| Any other person authorised by you | For the purpose authorised by you |
10. Unsubscribing from marketing messages
10.1 You can opt out of marketing and sales communications at any time by clicking on the "unsubscribe" or "opt-out" link in the marketing e-mails or messages we send you. You can also contact us at support@gomarloo.com.
11. What happens if Personal Information is not provided
11.1 Where we require certain Personal Information from you in order to provide a service to you, and you choose not to provide us with that Personal Information, we may not be able to provide our services to you, or aspects of those services. If this is the case, we will inform you.
12. Contacting us and complaints
12.1 If you have questions, requests or concerns about your Personal Information or this Privacy Policy, please email us at compliance@gomarloo.com or write to us at 121 Castlereagh St, Sydney NSW 2000, Australia. Our Data Protection Lead is Shakeel Lala.
12.2 We will take such steps as are reasonable to investigate any issues within a reasonable time of receipt. We will give you written notice of the investigations which have been carried out and the outcome.
12.3 Whilst you are entitled to submit a complaint to the Office of the Australian Information Commissioner with any concerns, we would encourage you to contact us first so that we can try to address your concerns.
ADDITIONAL CLAUSES APPLICABLE TO RESIDENTS OF AUSTRALIA
13. Scope
13.1 Your rights in this Privacy Policy apply in respect of Personal Information, as defined in the APA.
13.2 If there is any inconsistency between this "Additional Clauses Applicable to Residents of Australia" section and the rest of the Privacy Policy, this section will prevail.
14. Transfers of Personal Information out of Australia
14.1 Your Personal Information may be transferred overseas or stored overseas for a variety of reasons. If we transfer your Personal Information to a recipient in a country with data protection laws which are at least substantially similar to the Australian Privacy Principles ("APP"), and where there are mechanisms available to you to enforce protection of your Personal Information under that overseas law, we will not be liable for a breach of the APP if your Personal Information is mishandled in that jurisdiction.
15. Notifiable Data Breach Scheme ("NDBS") pursuant to the APA
15.1 If there is a data breach and we are required to comply with the NDBS, we will take all reasonable steps to contain the suspected or known breach where possible and follow the process set out in this clause.
15.2 If we have reasonable grounds to suspect that the data breach is likely to result in serious harm to any individuals involved, then we will take all reasonable steps to ensure an assessment is completed within 30 days after we become aware that there are reasonable grounds to suspect an eligible data breach, or sooner, if possible. We will follow all guidance published by the Office of the Australian Information Commissioner ("OAIC") in making this assessment. If we reasonably determine that the data breach is not likely to result in serious harm to any individuals involved, or that any remedial action we take is effective in preventing serious harm from becoming likely, then we will not notify the affected individuals or the OAIC.
16. Your rights under the APP and the APA
16.1 If you are a resident of Australia, your data protection rights are as follows:
16.1.1 You can request access to your Personal Information, subject to certain exceptions.
16.1.2 You can request corrections to any inaccurate, outdated, incomplete or misleading information regarding your Personal Information.
16.1.3 We have an independent obligation to take reasonable steps to correct information that is inaccurate, out-of-date, incomplete, irrelevant or misleading.
16.1.4 You can ask us to delete or de-identify your Personal Information if there is no good reason for us to continue holding it.
16.1.5 You can ask to have your Personal Information, where technically feasible, sent to another organisation, where we hold this Personal Information with your consent or for the performance of a contract with you.
16.1.6 You can ask us not to send you any marketing materials. However, we may still send you newsletters and updates about your account, if you are a business contact.
16.1.7 If you are unhappy with the way we collect and use your Personal Information, you can complain to the OAIC, but we would encourage you to contact us first so that we can try to address your concerns.
16.2 To contact us or submit requests in relation to any of the above, please email compliance@gomarloo.com with full details of your request.
16.3 If your request relates to unsubscribing or opting out of marketing, you can contact us on support@gomarloo.com.
17. Automated decision making
17.1 We do not make decisions about you that are based solely on automated processing and that produce legal effects concerning you or similarly significantly affect you. The outputs of the Marloo Service (such as draft fact-finds, review letters, meeting notes, and similar materials) are generated to assist our Customers (financial advisers and their firms) in their work; the financial adviser remains responsible for reviewing, validating, and acting on those outputs, and is the decision-maker for any actions affecting their clients.
18. Children's Personal Information
18.1 The Marloo Service is not directed to, nor intended for use by, individuals under the age of eighteen (18). We do not knowingly collect Personal Information from individuals under the age of eighteen (18).
18.2 If we become aware that we have collected Personal Information from an individual under eighteen (18) years of age, we will take reasonable steps to delete that information. If you believe we may have collected Personal Information from a person under eighteen (18), please contact us at compliance@gomarloo.com.
© 2026 Marloo. All rights reserved.